Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 10
1,194 packages with LPM's own review, newest scan first. Showing 433–480.
This is concrete import-time remote code execution, not legitimate telemetry: no payload authenticity check is enforced and the downloaded binary is executed detached. Block publication.
The package has no legitimate SDK functionality beyond a minimal class, while import-time code performs covert remote binary staging and execution. This is a concrete arbitrary-code-execu...
The entrypoint makes remote payload execution import-time behavior, not an inert or user-invoked utility. Lack of lifecycle hooks does not mitigate arbitrary execution when an application...